[Unit]
Description=Post install service

[Service]
Type=oneshot

# Clean up previous installation's artifacts.
ExecStartPre=rm -f /var/google/install/progress_status.json
ExecStartPre=rm -rf /var/google/firmware_bundle/
ExecStartPre=rm -f /mnt/luks-mmcblk0_fs/bundle_files.SHA256SUM
ExecStartPre=rm -f /mnt/luks-mmcblk0_fs/bundle_files.SHA256SUM.sig

# Untar the manifest and its signature.
ExecStartPre=tar -xzf /mnt/luks-mmcblk0_fs/firmware_bundle.tar.gz \
  -C /mnt/luks-mmcblk0_fs/ \
  --no-same-owner --restrict \
  ./bundle_files.SHA256SUM \
  ./bundle_files.SHA256SUM.sig

# Clear and recreate the firmware bundle directory.
ExecStartPre=rm -rf /mnt/luks-mmcblk0_fs/firmware_bundle/
ExecStartPre=mkdir -p /mnt/luks-mmcblk0_fs/firmware_bundle/

# Untar the ./firmware_bundle/ directory in the tar file
# into the /mnt/luks-mmcblk0_fs/firmware_bundle/ directory.
# --strip-components=2 removes . and /firmware_bundle from the path
#                      to avoid creating another firmware_bundle directory.
ExecStartPre=tar -xzf /mnt/luks-mmcblk0_fs/firmware_bundle.tar.gz \
  -C /mnt/luks-mmcblk0_fs/firmware_bundle/ \
  -k --no-same-owner --restrict \
  --strip-components=2 \
  ./firmware_bundle/

ExecStartPre=mkdir -p /var/google/install/

# Verify the bundle.
ExecStartPre=/usr/bin/verify_bundle.sh

# Set permissions and start install AFTER the bundle is verified;
# otherwise, we might grant permissions to malicious files.
ExecStartPre=chmod a+rwx -R /mnt/luks-mmcblk0_fs/firmware_bundle/
ExecStart=/usr/bin/installer_main --mode=post_install